TASK [ks-apigateway : ks-apigateway | Creating manifests] **********************
changed: [localhost] => (item={u'type': u'deploy', u'name': u'ks-apigateway', u'file': u'ks-apigateway.yaml'})
TASK [ks-apigateway : ks-apigateway | Installing ks-apigateway] ****************
changed: [localhost]
TASK [ks-apigateway : KubeSphere | Restarting ks-apigateway] *******************
changed: [localhost]
TASK [ks-controller-manager : ks-controller-manager | Getting ks-controller-manager installation files] ***
changed: [localhost]
TASK [ks-controller-manager : ks-controller-manager | Creating manifests] ******
changed: [localhost] => (item={u'type': u'deploy', u'name': u'ks-controller-manager', u'file': u'ks-controller-manager.yaml'})
TASK [ks-controller-manager : ks-controller-manager | Creating Controller Manager] ***
fatal: [localhost]: FAILED! => {"changed": true, "cmd": "/usr/local/bin/kubectl apply -f /etc/kubesphere/ks-controller-manager/ks-controller-manager.yaml", "delta": "0:00:02.228484", "end": "2019-09-06 06:20:17.941972", "failed_when_result": true, "msg": "non-zero return code", "rc": 1, "start": "2019-09-06 06:20:15.713488", "stderr": "Error from server (Forbidden): error when creating \"/etc/kubesphere/ks-controller-manager/ks-controller-manager.yaml\": clusterroles.rbac.authorization.k8s.io \"ks-controller-manager-role\" is forbidden: attempt to grant extra privileges: [PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"delete\"]}] user=&{system:serviceaccount:kubesphere-system:ks-installer c7d6e976-d06a-11e9-811a-005056aa092d [system:serviceaccounts system:serviceaccounts:kubesphere-system system:authenticated] map[]} ownerrules=[PolicyRule{APIGroups:[\"\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apps\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"extensions\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"batch\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"rbac.authorization.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apiregistration.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apiextensions.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"tenant.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"certificates.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"devops.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"monitoring.coreos.com\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"logging.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"jaegertracing.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"authorization.k8s.io\"], Resources:[\"selfsubjectaccessreviews\" \"selfsubjectrulesreviews\"], Verbs:[\"create\"]} PolicyRule{NonResourceURLs:[\"/api\" \"/api/*\" \"/apis\" \"/apis/*\" \"/healthz\" \"/openapi\" \"/openapi/*\" \"/swagger-2.0.0.pb-v1\" \"/swagger.json\" \"/swaggerapi\" \"/swaggerapi/*\" \"/version\" \"/version/\"], Verbs:[\"get\"]}] ruleResolutionErrors=[]", "stderr_lines": ["Error from server (Forbidden): error when creating \"/etc/kubesphere/ks-controller-manager/ks-controller-manager.yaml\": clusterroles.rbac.authorization.k8s.io \"ks-controller-manager-role\" is forbidden: attempt to grant extra privileges: [PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"mutatingwebhookconfigurations\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"admissionregistration.k8s.io\"], Resources:[\"validatingwebhookconfigurations\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"virtualservices\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"networking.istio.io\"], Resources:[\"destinationrules\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"servicepolicies\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"servicemesh.kubesphere.io\"], Resources:[\"strategies\"], Verbs:[\"delete\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"get\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"list\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"watch\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"create\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"update\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"patch\"]} PolicyRule{APIGroups:[\"app.k8s.io\"], Resources:[\"apps\"], Verbs:[\"delete\"]}] user=&{system:serviceaccount:kubesphere-system:ks-installer c7d6e976-d06a-11e9-811a-005056aa092d [system:serviceaccounts system:serviceaccounts:kubesphere-system system:authenticated] map[]} ownerrules=[PolicyRule{APIGroups:[\"\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apps\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"extensions\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"batch\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"rbac.authorization.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apiregistration.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"apiextensions.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"tenant.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"certificates.k8s.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"devops.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"monitoring.coreos.com\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"logging.kubesphere.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"jaegertracing.io\"], Resources:[\"*\"], Verbs:[\"*\"]} PolicyRule{APIGroups:[\"authorization.k8s.io\"], Resources:[\"selfsubjectaccessreviews\" \"selfsubjectrulesreviews\"], Verbs:[\"create\"]} PolicyRule{NonResourceURLs:[\"/api\" \"/api/*\" \"/apis\" \"/apis/*\" \"/healthz\" \"/openapi\" \"/openapi/*\" \"/swagger-2.0.0.pb-v1\" \"/swagger.json\" \"/swaggerapi\" \"/swaggerapi/*\" \"/version\" \"/version/\"], Verbs:[\"get\"]}] ruleResolutionErrors=[]"], "stdout": "deployment.extensions/ks-controller-manager configured\nserviceaccount/ks-controller-manager unchanged\nclusterrolebinding.rbac.authorization.k8s.io/ks-controller-manager-rolebinding unchanged", "stdout_lines": ["deployment.extensions/ks-controller-manager configured", "serviceaccount/ks-controller-manager unchanged", "clusterrolebinding.rbac.authorization.k8s.io/ks-controller-manager-rolebinding unchanged"]}
PLAY RECAP *********************************************************************
localhost : ok=47 changed=39 unreachable=0 failed=1 skipped=9 rescued=0 ignored=1